ci: stop the Actions cache quota from killing every main Docker build (#981)

Every push to main since 2026-07-24 failed the Docker workflow with
`failed to solve: not_found`, always at `#40 exporting to GitHub Actions
Cache`. PRs passed because they set `cache-to: ''` and only read.

Root cause is the shared 10GB Actions cache quota, not the Dockerfile.
rust.yml used a plain `actions/cache`, and Actions caches are scoped
per-ref, so every PR wrote its own ~1.2GB copy of the same key. Six
copies held 7.22GB of the 10GB budget; the repo sat pinned at 10.44GB.
That left under 3GB for buildkit, so a mode=max export of the
cargo-chef build evicted its own already-uploaded blobs and 404'd
finalizing the manifest. The recoverable `#28 CACHED` ->
`#28 ERROR: not_found` earlier in the same logs is the same eviction
hitting the import side.

#977's serialization addressed docker-vs-docker contention, but the
competitor was rust.yml — run 30175930394 was alone in flight and still
failed. The concurrency block stays; it's still worth not running three
90-minute builds at once.

- rust.yml: split cache into restore/save, save only on main pushes.
  PRs stay warm via restore-keys against main's copy. Frees ~6GB.
- docker-publish.yml: move the buildkit cache to a GHCR registry cache,
  which is outside the Actions quota, so the two workflows stop
  competing for it at all. Login is ungated so PRs can read it.
- docker-publish.yml: drop setup-qemu-action. We build linux/amd64 on
  an amd64 runner, so it did nothing but park a 32MB binfmt cache per
  ref (13 of them, 419MB).

Also pruned the five merged-PR cargo caches and the stale binfmt
entries out of band: the repo is now at 4.0GB across 18 entries.

Diff is YAML-only, so clippy can't be affected; `cargo fmt --all --
--check` passes.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: akarras

.github/workflows/docker-publish.yml

@@ -52,14 +52,15 @@ jobs:
               with:
                   submodules: recursive
 
-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
+            # No QEMU: we build linux/amd64 only, on an amd64 runner. It bought
+            # us nothing and parked a 32MB binfmt cache on every ref.
 
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v3
 
+            # PRs log in too — they don't push, but they read the registry
+            # build cache below, which needs auth if the package is private.
             - name: Log in to registry
-              if: github.event_name != 'pull_request'
               uses: docker/login-action@v3
               with:
                   registry: ${{ env.REGISTRY }}
@@ -81,10 +82,16 @@ jobs:
                   push: ${{ github.event_name != 'pull_request' }}
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}
-                  cache-from: type=gha
+                  # Registry cache, not type=gha. A mode=max export of this
+                  # cargo-chef build is multiple GB and shares the repo's 10GB
+                  # Actions cache quota with rust.yml; once that filled up,
+                  # GitHub evicted blobs mid-export and every main build died
+                  # with `failed to solve: not_found`. GHCR storage is outside
+                  # that quota, so the two workflows stop competing.
+                  cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
                   # PRs read main's cache but don't write — avoids thrashing
                   # the shared cache from short-lived branches.
-                  cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }}
+                  cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}/{1}:buildcache,mode=max', env.REGISTRY, env.IMAGE_NAME) || '' }}
 
             - name: Install cosign
               if: github.event_name != 'pull_request'
@@ -128,7 +135,7 @@ jobs:
                   outputs: type=local,dest=./debug
                   # Reuse the layer cache the main build already populated;
                   # this step just emits the unstripped binary as a local file.
-                  cache-from: type=gha
+                  cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
 
             - name: Upload debug symbols to GlitchTip
               if: steps.glitchtip-check.outputs.configured == 'true'

.github/workflows/rust.yml

@@ -39,8 +39,15 @@ jobs:
               with:
                   toolchain: nightly-2026-01-06
                   components: rustfmt, clippy
-            - name: Cache cargo registry and build artifacts
-              uses: actions/cache@v4.2.0
+            # Restore on every run, but only *save* from main. Actions caches
+            # are scoped per-ref, so a plain actions/cache here wrote a fresh
+            # ~1.2GB copy of this key for every PR — six of them filled 69% of
+            # the repo's 10GB quota, and GitHub's LRU then evicted the Docker
+            # workflow's buildkit blobs mid-export (`failed to solve:
+            # not_found`). PRs still get a warm cache: restore-keys falls back
+            # to main's copy.
+            - name: Restore cargo registry and build artifacts
+              uses: actions/cache/restore@v4.2.0
               with:
                   path: |
                       ~/.cargo/bin
@@ -79,6 +86,21 @@ jobs:
               # it would be good to support --all-features, but xiv-gen is a little unstable.
               run: cargo clippy --all-targets -- -D warnings
 
+            # Only main writes the cache (see the restore step above). Runs on
+            # failure too, so a red lint run still leaves the next build warm;
+            # skipped when the key already exists, hence continue-on-error.
+            - name: Save cargo registry and build artifacts
+              if: ${{ !cancelled() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+              continue-on-error: true
+              uses: actions/cache/save@v4.2.0
+              with:
+                  path: |
+                      ~/.cargo/bin
+                      ~/.cargo/registry
+                      ~/.cargo/git
+                      target
+                  key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
             #- name: Run cargo-deny, outdated, udeps, audit, and pants
             #  run: |
             #      cargo deny check